docs(product): port spawn-control design record from orion (SEA-1361)

docs/designs/product/DECISIONS.md

@@ -242,3 +242,16 @@ check enforces the mechanical half. Full rationale:
 | DL-159 | One UI codebase renders in two hosts — the Wails v3 desktop app (primary) and the browser (the managed/hosted product at `compass.rigel.build`) — over the same transport-agnostic UI above the `connection.ts` provider seam; the layout is fluid within its window/viewport (a dense supervision surface that reflows, not a fixed-pixel canvas and not a mobile redesign) (D6/§Global Constraints 2) | Active (Matt, 2026-08-05) | [ux foundation §D6](compass-ux-foundation/design.md#d6--rendering-the-frozen-ia-surface-by-surface-composition) |
 | DL-160 | The desktop app is first-class multi-window: every top-level surface (Bridge, a channel, an agent workspace, Backlog/Done, Settings) is an independently mountable window-scoped view (own DL-127 route, own focus zones + command scope, no sibling region required); compass-native spawns/manages OS windows, this record owns the decomposition; in-window tabs (Linear-style) and split views are deferred to the Beta milestone (SEA-1808), admitted by the same decomposition without rework (D6.1) | Active (Matt, 2026-08-05) | [ux foundation §D6](compass-ux-foundation/design.md#d6--rendering-the-frozen-ia-surface-by-surface-composition) |
 | DL-184 | Token adoption is a FULL CUTOVER, not the DL-157 incremental strangler: a pre-dogfood codebase has no live users to protect, so the legacy `:root` tier is deleted and every consumer flips to `--cx-*` in one atomically-merged migration (canvas → Night Owl, base.css un-shadowed, state dots recolored, D7 stylelint guard wired directly at error), proven by a Playwright visual-smoke harness Matt reviews | Active (Matt, 2026-08-07) | [DS token cutover](compass-ds-token-cutover/design.md) |
+
+## Bridge spawn control
+
+| ID | Decision | Status | Record |
+| --- | --- | --- | --- |
+| DL-164 | Adding a workstream and starting an agent are two separate operations: `addWorkstream` is a board-only mutation (no lifecycle RPC), `startAgent` is the lifecycle call, and `SpawnAgent` rejects when the target agent already holds a live session; agents own multiple workstreams (binding map keyed by workstream, not agent) inside one container/one live session, and the add flow can create agents via the existing `CommsService.CreateAgent` | Active (Matt, 2026-07-24) | [spawn control §Control flow](compass-spawn-control/design.md#control-flow-add-a-workstream-no-rpc-vs-start-an-agent-spawnagent) |
+| DL-165 | The Bridge spawn-control lane builds live-wired against the shipped `AppStoreOptions` client seam (real RPC awaits when clients are present, surfaced offline refusals when not — the shipped `stopAgent` shape), superseding the orion walking-skeleton posture whose premises (no injection seam, no live streams, stub stop) no longer hold in compass; parked for Matt's ratification (OQ-P1) | Active (compass port amendment, 2026-08-07) | [spawn control §Posture](compass-spawn-control/design.md#posture-live-wired-from-the-start-amends-orions-walking-skeleton--dl-165) |
+| DL-166 | Spawn is one server-side composite `CompassService.SpawnAgent` RPC orchestrating Provision→Start under a single `client_request_id` with server-owned end-to-end dedup (retry returns the same `session_id`, no second container) and a pre-Provision reject-on-live short-circuit ordered after the dedup-join lookup; client-orchestrated two-call flow rejected | Active (Matt, 2026-07-24) | [spawn control §DL-166](compass-spawn-control/design.md#dl-166-orion-oq-d--dl-055--server-side-composite-spawnagent) |
+| DL-167 | `AgentSessionStatus` gains `agent_account_id`, populated at every construction site (board projection, SubscribeEvents push synthesis, Runner-side Status) — a join onto the live hub binding Server-side and new Runner-local account carriage (AgentSpec→handle→liveSession), with the terminal STOPPED status resolving its account before `unbindSession`; makes the UI reconcile full-fleet within the binding's live scope and is the prerequisite of the reject-on-live scan | Active (Matt, 2026-07-24) | [spawn control §DL-167](compass-spawn-control/design.md#dl-167-orion-oq-g--dl-056--agent_account_id-on-agentsessionstatus) |
+| DL-168 | A stopped card stays restartable: the card's start affordance shows on no-binding OR a `stopped` binding (agent not live), the exact predicate the `startAgent` guard reads, and restart mints a fresh binding — a no-binding-only affordance would strand every stopped card since `applyStopped` keeps the binding | Active (Matt, 2026-07-26) | [spawn control §DL-168](compass-spawn-control/design.md#dl-168-orion-oq-h--dl-057--a-stopped-card-stays-restartable) |
+| DL-169 | Retry renders on `spawn-failed` only; a `stop-failed` card recovers by re-issuing the idempotent stop (`beginStop` accepts `running` \| `stop-failed`, and stop enablement covers `stop-failed`), because the session is still held and re-sending `SpawnAgent` would be bounced by reject-on-live | Active (Matt, 2026-07-26) | [spawn control §DL-169](compass-spawn-control/design.md#dl-169-orion-oq-i--dl-058--retry-is-spawn-failed-only) |
+| DL-170 | The spec gains a SHALL binding one container per agent account, so the agent-scoped reject-on-live rule is contract-backed rather than resting on the Runner's incidental container-name derivation (`NamePrefix + accountID`); lands with the T0 wire changes | Active (Matt, 2026-07-26) | [spawn control §DL-170](compass-spawn-control/design.md#dl-170-orion-oq-j--dl-059--one-container-per-agent-account-shall) |
+| DL-171 | `SpawnAgent` classifies `adminOnly` on the network door, alongside the sibling lifecycle RPCs (it provisions AND starts — strictly more powerful); the Bridge control surface is bootstrap-admin-only for MVP, and any future non-admin opening is `authenticatedOpen` + per-account authorization in the handler, not a bare reclassification | Active (Matt, 2026-07-26) | [spawn control §DL-171](compass-spawn-control/design.md#dl-171-orion-oq-k--dl-060--spawnagent-ships-adminonly) |